WASM-in-node e2e test tier for shard contracts (load-bearing assumptions unverified)

[iduartgomez]

Tracks the deferred live-node test tier surfaced repeatedly in ADR-0001 (docs/adr/0001-implementation-notes.md → 'Testing tiers'). Currently the contract 'integration' tests drive the contracts as a Rust library, not the compiled WASM inside a running node, so an entire class of behavior is unverified.

Load-bearing assumptions this tier must confirm

1. GET-of-never-instantiated-contract REJECTS. The web app instantiates a shard by GET-probing a derived key and PUTting only on reject/timeout (userShardExists / ensureThreadShard in web/src/freenet-api.ts). If the node instead resolves the GET with empty state, the app skips the PUT, the contract is never created, and the first post/like UPDATE silently no-ops. Never verified against a live node.
2. Client key derivation == node byte-for-byte. blake3(code_hash || params) is pinned in web/src/shard-key.test.ts against recorded fdev get-contract-id vectors, but nothing re-derives in CI to catch the node algorithm drifting. Per-encoding (raw VK bytes vs utf8 post-id string).
3. No WASM trap / host-ABI fault on the real PUT/GET/UPDATE/summarize/delta paths (the pure-Rust tier can't see traps; contracts forbid unwrap precisely because traps are silent in the sandbox).

Minimal scope

Via the freenet:linux-test / freenet:local-dev skills: boot a local node, PUT a user shard at a derived key, GET it back, UPDATE with a signed delta, GET again and assert convergence; then GET a different derived-but-never-PUT key and assert the documented reject/empty behavior. Extend to thread shard (like/reply/quote) + two-peer sync. Heavier than per-PR CI — run on a self-hosted runner as a separate non-blocking job.

Also: delegate process() end-to-end

The identity delegate now has unit tests for its signing helpers, but the full process() request path (JSON Request→Response, secret store) can't run on the host target (WASM-only secret-store host import) and is only reachable from this node tier.

Refs: #33 (shards-only cutover), docs/adr/0001-implementation-notes.md

[iduartgomez]

Status update (2026-05-27, ADR-0001 cutover merged through #36).

This tier is now the single highest-risk open item for ADR-0001. The shard architecture is fully built and merged (#24–#36), but assumption #1 above — GET-of-never-instantiated-contract REJECTS — is still the load-bearing premise of the whole instantiate-on-probe cutover (userShardExists / ensureThreadShard) and remains unverified against a live node. If the node resolves an uninstantiated GET with empty state instead of rejecting, the first post/like UPDATE silently no-ops.

Note also: the GET-serialization fix (#35) and the like-failure-revert (#36) added client-side robustness, but they too are only exercised by vitest mocks — the real FIFO behavior of pendingGets and the 30s REQUEST_TIMEOUT_MS drain are confirmed only by reading stdlib source, not by a live round-trip. This tier should also cover a two-flow concurrent-GET scenario to confirm serializedGet holds against the real node.

No code change since the issue was filed; restating priority.